CVE-2024-10976

CVE Details

Release Date:	2024-11-14
Impact:	Moderate	What is this?

Description

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

See more information about CVE-2024-10976 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.2
Vector String:	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	Low
Integrity Impact:	Low
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (pg_repack)	ELSA-2024-10785	2024-12-06
Oracle Linux version 8 (pg_repack)	ELSA-2024-10830	2024-12-06
Oracle Linux version 8 (pg_repack)	ELSA-2024-10831	2024-12-05
Oracle Linux version 8 (pg_repack)	ELSA-2024-10832	2024-12-05
Oracle Linux version 8 (pgaudit)	ELSA-2024-10785	2024-12-06
Oracle Linux version 8 (pgaudit)	ELSA-2024-10830	2024-12-06
Oracle Linux version 8 (pgaudit)	ELSA-2024-10831	2024-12-05
Oracle Linux version 8 (pgaudit)	ELSA-2024-10832	2024-12-05
Oracle Linux version 8 (postgres-decoderbufs)	ELSA-2024-10785	2024-12-06
Oracle Linux version 8 (postgres-decoderbufs)	ELSA-2024-10830	2024-12-06
Oracle Linux version 8 (postgres-decoderbufs)	ELSA-2024-10831	2024-12-05
Oracle Linux version 8 (postgres-decoderbufs)	ELSA-2024-10832	2024-12-05
Oracle Linux version 8 (postgresql)	ELSA-2024-10785	2024-12-06
Oracle Linux version 8 (postgresql)	ELSA-2024-10830	2024-12-06
Oracle Linux version 8 (postgresql)	ELSA-2024-10831	2024-12-05
Oracle Linux version 8 (postgresql)	ELSA-2024-10832	2024-12-05
Oracle Linux version 9 (pg_repack)	ELSA-2024-10787	2024-12-06
Oracle Linux version 9 (pg_repack)	ELSA-2024-10788	2024-12-04
Oracle Linux version 9 (pgaudit)	ELSA-2024-10787	2024-12-06
Oracle Linux version 9 (pgaudit)	ELSA-2024-10788	2024-12-04
Oracle Linux version 9 (pgvector)	ELSA-2024-10788	2024-12-04
Oracle Linux version 9 (postgres-decoderbufs)	ELSA-2024-10787	2024-12-06
Oracle Linux version 9 (postgres-decoderbufs)	ELSA-2024-10788	2024-12-04
Oracle Linux version 9 (postgresql)	ELSA-2024-10787	2024-12-06
Oracle Linux version 9 (postgresql)	ELSA-2024-10788	2024-12-04
Oracle Linux version 9 (postgresql)	ELSA-2024-10791	2024-12-10